COS (HA / full) terraform missing option for S3 endpoint SSL CA

[gustavosr98]

For most on-premise deployments S3 endpoint will not have a public trusted SSL CA
Eg. pointing to a Ceph deployment or to a Netapp S3 endpoint

We need to add an option to provide this on the terraform bundle and expose it in needed charms that use the S3 endpoint configured here
https://github.com/canonical/observability-stack/blob/main/terraform/cos/variables.tf#L65

[gustavosr98]

Each COS charm (eg. tempo) seems to use s3-integrator for this
This charm already exposes that option https://charmhub.io/s3-integrator/configurations#tls-ca-chain
Now it would only be a matter of exposing it in the terraform variables

In case the s3_endpoint is only used to be passed to each s3-integrator instance, then this would have a workaround
First deploy the bundle
Then go through each s3-integrator application and update the value of tls-ca-chain config

[sed-i]

If the s3 backend is not charmed, then seems like the best approach is the tls-ca-chain config option.
If the s3 backend is charmed, then perhaps adding recv-ca-cert relation to all relevant charms is neater (example).

Would you be able to provide additional information on your deployment scenario, for reference?

Related: canonical/manual-tls-certificates-operator#255

[sed-i]

So you can already pass config options from your main.tf, something along the lines of:

    module "cos" {
      source                          = "git::https://github.com/canonical/observability-stack//terraform/cos"
      model_uuid                      = juju_model.cos.uuid
      channel                         = "2/edge"
      ...
+     s3_integrator = { config = {tls-ca-chain = "..."} }
    }

This one setting will apply to all 3 s3-integrators.

@gustavosr98 are you looking for a different solution?

[gustavosr98]

Ahh that should work, thanks! @sed-i

[MichaelThamm]

Please let us know if this works @gustavosr98 so we can add it to our TLS docs

[MichaelThamm]

@gustavosr98 any updates?